Hacker News Reader

Comment by severino | Hacker News Reader

Whatever they come up with, I hope it doesn't tie you to a Google or Apple smartphone.

Can't we have cards for this? In Spain, for example, to use Bizum, you need either an Android/iOS smartphone (and for the Android case, as you use it from your bank's app, it would typically require some Google security assurances - so no Huawei phones allowed, for example) or logging into your bank's website and use Bizum from there, only if your bank allows you to use Bizum via web. And it's not very practical or convenient to do that when you're in a store and want to pay, in contrast to swiping your credit card.

So while I see very convenient gaining some sovereignty from American companies for these payments, I think we're losing it when we will need devices controlled by other American companies in order to use the new system.

View on HN

This is really a human right issue. No one should be required to carry an attacker-controlled tracking device, especially not for interacting with the government. It's funny that the EU uses all this mobile attestation BS more than the US does. So much for sovereignty and consumer protection. No monopoly Google can build is as good as the government forcing you to accept their terms.

> It's funny that the EU uses all this mobile attestation BS more than the US does

Attestation in on itself isn't unwarranted which (to me) is an important security measure. Attestation as commonly implemented on Android via Play Integrity (the way banking apps are known to do) is restrictive, sure: https://grapheneos.org/articles/attestation-compatibility-gu... / https://archive.is/snGEu

An important security measure for who, though? The servers at the bank should "never trust the client" in case the attestation is bypassed or compromised, which is always a risk at scale.

If it's an important safety measure _for me_, shouldn't I get to decide whether I need it based on context?

I think it's fair for banks to apply different risk scores based on the signals they have available (including attestation state), but I also don't want the financial system, government & big tech platforms to have a hard veto on what devices I compute with.

It's an anti-brute-force mechanism. It's not for you, it's for all the other accounts that an unattested phone (or a bot posing as an unattested phone that just stole somebody's credentials via some 0-day data exfiltration exploit) may be trying to access.

Sure, banks could probably build a mechanism that lets some users opt out of this, just as they could add a Klingon localization to their apps. There just isn't enough demand.

If you work on mobile apps you will notice that full attestation is too slow to put in the login path. [This might be better than it used to be, now in 2026].

I don't think a good security engineer would rely on atty as "front line" anti brute force control since bypasses are not that rare. But yeah you might incorporate it into the flow. Just like captchas, rate limiting, fingerprints etc and all the other controls you need for web, anyway.

I know I'm quibbling. My concern is that future where banks can "trust the client" is a future of total big tech capture of computing platforms, and I know banks and government don't really care, but I do.

> total big tech capture of computing platforms

Correct. And the end of ownership, privacy, and truth too. If something can betray you on someone else's orders, it's not yours in the first place. You'll own nothing and if you aren't happy, good luck living in the woods.

> you work on mobile apps you will notice that full attestation is too slow to put in the login path

Hm, Play Integrity isn't that slow on Android, from my experience.

> don't think a good security engineer would rely on atty as "front line" anti brute force control since bypasses are not that rare

I'm not privy to device-wide bypasses of Play Integrity that ship with Trusted Execution Environment (which is pretty much all ARM based Androids), Secure Element, and/or Hardware Root of Trust, but I'd appreciate if you have some significant exploit writeups (on Pixels, preferably) for me to look at?

> My concern is that future where banks can "trust the client" is a future of total big tech capture of computing platforms

A valid concern. In the case of smart & personal devices like Androids though, the security is warranted due to the nature of the workloads it tends to support (think Pacemaker / Insulin monitoring apps; government-issued IDs; financial instruments like credit cards; etc) and the ubiquity & proliferation of the OS (more than half of all humanity) itself.

> Insulin monitoring apps

A monitoring app doesn't even interact with systems you don't own. Just put a liability disclaimer for running modified versions.

> warranted

Decided by whom? And why is Google trusted, not me? At minimum, I shouldn't face undue hardship with the government due to refusing to deal with a third party, unless we first remove most of Google's rights to set the terms.

> A monitoring app doesn't even interact with systems you don't own. Just put a liability disclaimer for running modified versions.

This is unserious when Insulin overdose can be fatal.

> And why is Google trusted, not me?

(Hardware-assisted) Attestation on Android doesn't require apps to "trust Google".

> I'm not privy to device-wide bypasses of Play Integrity that ship with Trusted Execution Environment (which is pretty much all ARM based Androids), Secure Element, and/or Hardware Root of Trust, but I'd appreciate if you have some significant exploit writeups (on Pixels, preferably) for me to look at?

Hi, you don't have the break the control on the strongest device. You only have to break it on the weakest device that's not blacklisted.

The situation is getting better as you note, but in the past the problem was that a lot of customers have potatos and you get a lot of support calls when you lock them out.

> think Pacemaker / Insulin monitoring apps; government-issued IDs; financial instruments like credit cards; etc

I agree with you on the need for trustworthy computing. I mainly disagree on who should ultimately control the trust roots.

We can only hope they continue to be found so there would at least be a small cost for this kind of indignity.

> Insulin monitoring apps

Funny that you say that, but the so far best artificial pancreas that is completely free and open source will soon be much harder to install to any Android phone without every user getting a valid key from Google.

In Germany, doctors even recommend these tools if they work. Because they make patients who know what they are doing healthier and more safe.

Naturally me and hundreds of other diabetics have already contacted our EU representative due to the changes Google is planning to make in their platform.

https://androidaps.readthedocs.io/en/latest/

This tool has literally saved my life.

It isn't that these tools are not useful, just that successful exploits on those may be fatal for the enduser.

> important security measure

It's a security measure against the owner of the device, in other words, an attack. Would you be okay with me using a remote control to forcibly slow down your car so I can merge? Using attestation this way is fundamentally incompatible with ownership. If the bank wants some assurance about a device, they need to sell or issue one to me, like credit cards or point of sale machines, which are explicitly not your property.

The fact that the assurance is provided by a third party you have little recourse against just adds insult to injury.

> If the bank wants some assurance about a device, they need to sell or issue one to me, like credit cards or point of sale machines, which are explicitly not your property.

In this example, a banking app is not making the entire Android device non functional when it refuses to work when remote attestation like Play Integrity fails.

It is colluding with a third party to increase their power. What devices pass Play Integrity? Yeah, the same ones with all the telemetry and spying that you can't remove. I thought the government is supposed to protect consumer rights, not to tilt the playing field even further.

Like I said, I'd be fine if they offer a viable alternative, like a card or a physical authentication dongle (which doesn't require spyware to use).

I don't want to depend on google and android for EU mobile attestation or the like. I didn't think anyone wants government enforced duopolies.

>against the owner of the device

Would you consider MFA to be a measure against you, the owner of the device, because it makes it harder for you to login?

>If the bank wants some assurance about a device, they need to sell or issue one to me

They are offering you free software and are operating under a security model tied to these specific devices. You're still free to walk into their branches, or use their physical cards, if you prefer not use their limited selection of devices.

>Would you be okay with me using a remote control to forcibly slow down your car

Car manufacturers do this as well though. Some of this is for the benefit of their customers (preventing theft from easily cloned keys). Some of this is not for customer benefit, like locking down infotainment systems.

Banks however are only interested in preventing fraud.

> MFA to be a measure against you

Not really, unless the MFA involves the same type of attestation involved in the process. TOTP is fine, and you can put it in your password manager to avoid phones, and can be done without consenting to any spying. And I don't really own the account anyway.

> use their physical cards

The premise of this discussion is these will get replaced by the hostile phone app, since the Europeans are too lazy to make a proper replacement.

> locking down infotainment systems

I don't agree with that either, but you can presumably buy a car without one, and you'd still be allowed to drive. What if the government says, you can't drive anymore UNLESS you use the locked down infotainment system and consent to all the ads/spying that comes with it?

> Would you consider MFA to be a measure against you, the owner of the device, because it makes it harder for you to login?

In theory - of course, it shouldn't make it any harder for _me_ to login, it's just that in practice the friction is inevitable since it can't distinguish between me and someone else without it.

> You're still free to walk into their branches, or use their physical cards, if you prefer not use their limited selection of devices.

The point is that this freedom is going away. I'd absolutely want to use their physical cards (there are smartcards with e-ink displays which would be a great thing for confirming payments), but no, they're slowly taking this away, starting by limiting transfers done without their mobile app.

And _their_ mobile app needs to invade __my__ property by locking down the system. I understand this might be neccessary to ensure the UI can be trusted, but this shouldn't happen on my device as it restricts my ability to do completely unrelated things.

>No one should be required to carry an attacker-controlled tracking device

What about being required to carry a your-own-government-controlled tracking device?

Because the US or Chine government can't harm me in Europe via the data they collect from me, But the EU authorities can if they want to, so naturally I fear them more if they were the ones hoovering my data.

What are the odds they're using this on-shore tech grab to implement their own domestic version of China's social credit score system, to easily get data on their own citizens who commit "wrong-think", without having to through the effort to twist the arm of US entities every time they want to do that?

Food for thought, but I do think we're living the last years of online anonymity, it's inevitable.

Tracking device might be the wrong thing to focus on. The US has other ways of messing with foreigners who depend on services provided by US companies, like suddenly cutting off those services in the case of ICC judges.

IIRC, ICC judges lost access to their O365 work email accounts. Worst the US can do to me is turn off my Steam, and Gmail but I can easily live without those.

Now imagine being debanked by your own government because they don't like what you're saying and becoming unemployed, homeless and dead. I don't think they're remotely comparable.

For example, a few years ago, a power tripping gov bureaucrat turned off my unemployment payments over a technicality. Luckily, I had enough money to pay a lawyer to sue them and won, but it was tight. What if I hadn't had the money to hire a lawyer? Since I was in a foreign country, with no family or close friends to fall back on. I was exclusively relying on the welfare state I paid into for years, that then turn its back on me for shits and giggles.

So I don't think you understand just how bad it can be for you if your government decides to turn on you and fuck with you, if you're comparing this to losing access to your work email account.

See the famous case of UK postal workers that got fucked by their government trying to hide their mistakes.

It's all the same. How is suing Google any different, if you instead get debanked by Google for violating their "terms"? The only solution is untraceable, permissionless money, like Monero. Why do you think governments try so hard to ban it?

> if you instead get debanked by Google for violating their "terms"

Since when is google a bank?

>The only solution is untraceable, permissionless money, like Monero. Why do you think governments try so hard to ban it?

Because untraceable currency is mostly used by criminals for crime.

Your bank (like most European ones) requires you to pass attestation to use their services. If you don't accept Google/Apple's terms, you can't access it without extreme difficulty.

I can always access my bank via a web browser or even in person at the teller at a branch somewhere, or as a last resort via snail mail from attorney, but most importantly even if I get locked out somehow by google, the account still runs and I won't be homeless as my salary and rent auto-payments keep going regardless if you can access it or not.

How is this comparable to your government debanking you meaning that no bank, landlord, layer or job will touch you?

It's less severe for sure, but I'd rather live without undue interference based on someone else's whims, unless I broke a law.

I... don't think you understand debanked. There is no movement OUT of your account. Deposits will be processed all day long. The intent is to tie up access to as many of your assets as possible. If you think anything of yours will just keep on going if you end up debanked, you're sadly mistaken. In addition, based on the U.S. Bank Secrecy Act as amended by the PATRIOT act, covered entities are forbidden from disclosing to you anything about why your account is frozen.

It's as close as you get to a complete shunning from modern society. You're reset to the cash you hold on you and keep custody of. And yes. In the U.S., the list that manages who can and cannot transact is centralized under OFAC. So it is at the whims of Executive whether or not any financial activity can be done with you.

The premise here is that you lose access to a European bank's mobile app because the US government compels Apple or Google to disable your app store accounts. Not that your relationship with the bank is frozen.

the account still runs and I won't be homeless as my salary and rent auto-payments

Luckily in most European countries renters are protected and they cannot just kick you out of your home for missing one rent payment (IANAL, but in NL it requires 3 months of no pay and a judge has to approve). Most likely they wouldn't approve if you missed a payment because you were locked out of your banking account.

My bank's app uses Google Pay to pay at POS terminals, so Google can at least block that.

Being de-Googled is a hardship, though there are replacements for virtually all its services. I acknowledge you are well informed on this topic.

It is not unreasonable for governments to pursue avenues for laundering money. I recognize that you likely don't believe governments should prosecute money laundering, but that view is not aligned with the majority of citizens in your country.

After a fair trial and appeals process, right?

Ah money laundering, the government's 2nd favorite excuse to bypass due process, remove freedom, and impose arbitrary punishments, after "emergency" and before "think of the children".

The government can prosecute money laundering and all the other crimes, but it's not an excuse to impose extrajudicial punishment. Until they stop, having some cash and crypto is your only means of defense.

I understand your threat model is centered around the risk of a government persecuting you. This will naturally conflict with incentives of people whose threat model centers around a lower severity but higher frequency event of systematic violence performed by criminal enterprises, with a necessary condition being ease of moving money. Both representative and totalitarian governments seek to aid investigation of criminal activity by following the movement of money.

I'm unsure about your reference to extrajudicial punishment, is it referring to de-banking associated with AML and KYC regimes in the US? If so, I agree that unjust things are unjust. I believe we should seek to fix those injustices directly through lobbying lawmakers, rather than rejecting an entire system that has significant security benefits.

I am sympathetic to people who have a fatalistic attitude when it comes to political reforms. Having other financial instruments as a backup is a good practice.

I'm not necessarily opposed to KYC or even government being able to audit transactions in general. But there is too few legal protections both from the bank and the from the government itself for this to be acceptable in a free society.

It's not entirely hopeless I guess. For what it's worth, the US government recently issued an EO that purportedly stops banks from debanking you for political reasons. Hopefully a future administration would take care of the other part.

Because financial sanctions are one of our main tools to pressure enemy countries into calming the fuck down in hopes of avoiding an actual kinetic conflict.

In 2025, North Korea managed to steal from the world over 10% of its GDP worth in cryptocurrency.

According to AP News (https://apnews.com/article/international-court-sanctions-tru...) at least one judge had his bank accounts closed. So it's not just your own government who can debank you in Europe.

Of course in this judge's case there might still be some banks who are willing to work with him even at the risk of getting sanctioned as there weren't language in the news that he was completely debanked which I assume they would highlight if it was the case.

The main problem IMHO that a bank access not seen as a right. Even Russia which is neither powerful (unlike the US) nor an EU ally can de-bank Russian critics living in the EU (and other places) by reporting them to FATF. AML is ripe for abuse.

> IIRC, ICC judges lost access to their O365 work email accounts. Worst the US can do to me is turn off my Steam, and Gmail but I can easily live without those.

They lost access to everything american, including Visa and Mastercard. It's in french and maybe not the best source but it's not paywalled :

https://www.tf1info.fr/international/nous-sommes-attaques-le...

> "Payments are mostly cancelled," he continued, "as almost all cards issued by banking institutions in Europe are either Visa or Mastercard, which are American companies."

They are not completely debanked since they can go to the bank and withdraw cash, but it's a crippling situation to be in.

You most likely use a Windows PC and an Android phone. If Uncle Sam viewed you as a threat actor, he could ask both companies to send you a signed and verified update to either your OS or apps they control, running whatever he wants.

> Now imagine being debanked by your own government because they don't like what you're saying and becoming unemployed, homeless and dead. I don't think they're remotely comparable.

You don't have to imagine it.

Alina Lipp, Thomas Röper, Xavier Moreau, Col Jacques Baud, Nathalie Yamb. The last two are Swiss nationals. The Baud case is interesting because he's a Belgian resident who now can not even buy food or pay his bills while living in his own home.

The odds are very low. It all depents on the people. So far, the European citizens are very privacy senstive. The European institutions are characterized by a huge devision of power. There is no chance that European instutitions can impose their will against a considerable majority of people. If people turn away from liberal democracy, that's another matter. But then everything is lost anyway.

> There is no chance that European instutitions can impose their will against a considerable majority of people

The EU commission just passed chat control to have government mandated software in every phone

If you want to over simplify at least do it right.

It's substantially neutered from the original proposal, with most of the scary parts taken out. I'd count that as a win as far as how antidemocratic the EU commission is.

https://www.eff.org/deeplinks/2025/12/after-years-controvers...

Given how many world leaders form the west had absolutely the most vile chats with Epstein about doing despicable things to people, I'd totally want chat control but only for our leaders. They certainly proved that's who needs it the most to keep us safe.

Do you have a citation for this? I can't find anything showing that 2022/0155(COD) has passed the EU Council or Parliament (nor can I find any scheduled votes). [1]

The most recent related information I could find was some movement to extend the temporary derogation of the ePrivacy Directive, which expires on 2026/04/03, to 2028/04/03 but even that did not seem to have passed yet. [2]

The very fact they're trying to extend the temporary derogation hints to me that they think it'll take some time yet to pass Chat Control (if at all).

[1] https://oeil.europarl.europa.eu/oeil/en/procedure-file?refer...

[2] https://oeil.europarl.europa.eu/oeil/en/procedure-file?refer...

> So far, the European citizens are very privacy senstive.

In some areas, sure - like GDPR.

In other areas, absolutely not - like chat control.

As another commenter pointed out, it seems as if government mandated privacy intrusion is OK, while violations by corporations are quickly shutdown. It’s like the opposite of how it works here in the US.

>it seems as if government mandated privacy intrusion is OK

Once you give people an outside boogieman(Putin, Trump, Covids, etc) or a self inflicted false flag crisis(surge in violent crime rates for example) to shake them up to their core and put the fear in them, you can then easily sell your intrusion of privacy in their lives and extension of the police state, as the necessary solution that protects them.

When you start lose control of your people because their standard of living has been going downhill for 2 decades and they realize the future prospects aren't any better so they hate you even more, you can regain control of them by rallying them up on your side in a us-versus-them type of game against external or internal aggressors that you paint as "the enemy". The media is your friend here. /s

This isn't an EU or US exclusive issue, it's everywhere with a government issue. The difference as to why the EU people seem to be more OK with government intrusion compared to the US, is that EU always has external aggressors the government can point to as justification for invasiveness and control, while the US has been and still is the unchallenged global superpower so it has no real external threats ATM, meaning division must be manufactured internally (left vs right, red vs blue, woke vs maga, skin color vs skin color, gender vs gender, etc) so that the ruling class can assert control in peace.

Either way, we all seem to be heading towards the same destination.

Amen to that.

I agree 100%. Europe is just ahead of us for the time being, but our turn is soon approaching...

You may say that, but last I checked, we don’t get stopped and shot in the streets by masked goons on government payrolls.

Sure, but I am talking about government-mandated surveillance through legislation.

Also, your police aren’t afraid to go the extra mile to quash dissent. Look at what’s happening in the UK for example with Palestine Action. The only difference is that they are less armed and better trained.

Remember how UK is not a part of the EU anymore for about a decade by now?

Pedantry at its finest. The UK is European and you know it - regardless of the technicalities.

Since you’re a pedant, look at what Germany is doing in this same area.

Oh boy, did I hurt your feelings or something? If you call this pedantry, I'll gladly be a pedant in your perception. I'll call you ignorant in return though. And since you are an ignorant (notice how I can also take an adjective and ascribe it to your whole personhood?) you probably won't know what the difference between Europe and the European Union is anyway, so there's little hope for a fruitful discussion.

> chat control

The Danish proposal for indiscriminate chat control did not receive enough support and was retracted last autumn. Similar proposals have been put forward regularly over the past 30 years and have so far come to nothing just as regularly.

The problem is they will keep trying just like before, and they only need to get lucky once to succeed, while we need to be lucky very single time.

This is a truism, but not that helpful. I have to be lucky every time I leave the house not to be murdered, but it doesn't substantially change my behaviour. Rather than freaking out or catastrophising we just need to focus on asserting and celebrating and educating citizens in our shared values (murdering is bad, privacy is important).

Nah, I think in this metaphor we need to lock up Mr.Stabby McStabFace instead of just allowing him to go without punishment for his repeated efforts to legalize face-stabbing.

> chat control

For the conservative (and sometimes not so conservative) non-experts things like this sound like an easy win. So every new generation of politicians has to be educated about it again.

> like chat control.

That has never been passed in any form.

> the opposite of how it works here in the US.

It appears that you have conveniently forgotten about FISA, EARN IT, CLOUD act, PATRIOT act, LAED, etc, etc.

https://www.eff.org/deeplinks/2025/12/after-years-controvers...

It hasn’t been passed in that “voluntary” form either.

35 years ago, a good chunk of the current EU was under a Soviet-imposed totalitarian rule. Spain was a dictatorship until 1975. And it's been just 80 years since WWII.

It always boggles my mind that most Europeans are absolutely convinced that nothing like that could ever happen again. Meanwhile, many people in the US are convinced that the government will be coming for them any minute now.

> It always boggles my mind that most Europeans are absolutely convinced that nothing like that could ever happen again.

It’s not that it cannot happen again. It’s that the EU is explicitly built against that and if it happens it will come from the national governments (see Hungary), not the EU.

> it will come from the national governments (see Hungary), not the EU.

what's the difference? The EU relies on national gov't to enforce rules. Until the EU becomes a sovereign entity with standalone enforcement mechanisms, it's no more able to ensure things can't happen than the UN.

>it's no more able to ensure things can't happen than the UN

It's not the same. EU will cut your funding if you don't follow their rules. UN is not finding any EU countries, but the opposite, we all pay to fund the UN.

National governments are often at odds with the commission. France was regularly threatened and fined for its energy policy, for example, which was not pro-business enough. All EU regulations are the result of horse trading in the council of ministers and the commission, the member states are not helpless victims or perfect enforcement forces blindly applying what the president of the commission of the day wants.

Maybe in theory, but the idea that nations that trade doesn’t go to war is a naive one, it has happened plenty and will happen again. As for the structure of voting etc, it’s just a matter of pushing until people give up.

Indeed, which is why entanglement goes deeper than simply trade. The emergence of pan-European companies like Airbus makes the cost for one country to go alone much steeper. Same for the establishment of EU-wide supply chains. There are also incentives to play nice in the form of the customs union and the single market. The moment you leave, you’re on the wrong side of a trade barrier.

How is the EU built against that and how does it matter?

The EU is built on rules that uphold liberal democratic principles, agreed to by national governments in a flush of post-WW2 clarity, and which tie successors to the same principles. There are exit mechanisms, but they impose large costs (i.e. Brexit).

You're saying nothing concrete in particular. What rules? How do they inhibit change? The only thing I can think of which is actually difficult to change is the echr and i see more than a dozen mostly liberal governments queueing up to change it (to little effect so far) over migration issues.

The ECHR isn't actually an EU thing. (It's a Council of Europe thing, which is separate from and predates the ECSC/EEC/EU.)

I know and it's a requirement for being in the EU still.

There are rules about election conduct and free operation of courts, to give two examples. Both of which Hungary skirts on occasion but the EU does apply some pressure.

> It’s that the EU is explicitly built against that and if it happens it will come from the national governments (see Hungary)

So to prevent individual EU nations ever becoming authoritarian, like Hungary, we have to cede sovereignty and authority to the EU & EC unelected bureaucrats like Ursula VDL who take over as the main executive leaders, ensuring we'll no longer have the danger of national-level authoritarianism.

Hell of a solution.

Surely the better solution to issues like Hungary is ensuring we get more democracy to Hungarian people, not giving authority over Hungary to someone else the Hungarian people can't elect.

US Supreme Court Judges are not elected. Although I hesitate to use this as an example currently, given how well the US separation of powers is (not) working, the point stands that all democratic systems need some kind of "damping" influence to survive. If successive national governments were hostile to EU bureaucrats there are options open to them to restore sovereignty — e.g. exit the EU, or force change in appointments by coordinating with other EU governments. The fact that senior positions in the EU are unelected does not in itself make the system un or anti democratic.

> So to prevent individual EU nations ever becoming authoritarian, like Hungary, we have to cede sovereignty and authority to the EU & EC unelected bureaucrats like Ursula VDL who take over as the main executive leaders, ensuring we'll no longer have the danger of national-level authoritarianism.

Not really, and the example of Hungary shows that it would not be that effective for that purpose.

The EU is a union of nations, not really of people. It was built so that nations play nice with each other. Each member state still does more or less what it wants within its borders, as long as it does not jeopardise the union.

In that way it’s not perfectly democratic, because there are layers of indirection between the citizens and the institutions.

Commissioners are nominated by member states and approved by parliament. So they are generally aligned with the politics dominant at the national level and palatable to MEPs. Von der Leyen is there because she had support from the German government and was from the dominant block in parliament. It’s not direct democracy, but it is not a faceless blob either.

> Meanwhile, many people in the US are convinced that the government will be coming for them any minute now.

It's a bit ironic that most of those people voted for Trump, who is now doing exactly that. But I guess they think it's ok as long as the government is coming for others, not for them (at least not yet)...

While I love the premise that he is choosing arbitrary groups to go after and we just haven't been chosen yet, no, he campaigned on this and was elected for exactly this. This is what the people want.

Sort of correct but also playing with words. Most, many.

There's a divide between generations and geographies to start with. Younger vs. older generations see things differently. Westerners vs. Easterners (especially those who remember the communist times) see things differently.

It's very hard to say what many and most people are doing on either side of the Atlantic. Until a few short years ago you wouldn't have imagined enough Americans would vote for the leader they did, knowing exactly what they're getting, and yet they did. So people aren't always forthcoming about their views and beliefs.

In Europe for anyone who can't remember the "hard times" it's easy to fall into the trap of believing things will stay good forever. The US hasn't had equivalent "hard times" relative to the rest of the world for as long as any person in the US has been alive and a few generations more. So they too can easily believe things can't turn sour, which is why this recent and swift downturn caused so much shock and consternation. But the US also always had a lot of preppers and people "ready to fight the Government" (that's why so many have guns, they say). It's a big place so you expect to have "many" people like this.

In Italy were already trying to break that division of power, we’ve a referendum that does just that

Very privacy sensitive? In Germany, maybe. Elsewhere in Europe, not so much. See the regular attempts to push through something like chat control.

> citizens are very privacy senstive

Their reaction and opposition to ChatControl (or near complete lack of both) would indicate otherwise? They could hardly care less about privacy.

National governments which have openly declared that believe they have the right to unlimited access to any private communication hardly lost any popularity or faced real consequences.

Every government is an attacker.

> What are the odds they're using this on-shore tech grab to implement their own domestic version of China's social credit score system, to easily get data on their own citizens who commit "wrong-think", without having to through the effort to twist the arm of US entities every time they want to do that?

What are the odds that once shut down "chat control" will come up under a new name?

> without having to through the effort to twist the arm of US entities every time they want to do that?

Right now, it's more like US corpos are try to twist the arm of EU governments [1][2], pushing heavy propaganda to manipulate our elections [3], allying with the US government to do so. And the US government has been threatening EU govts with invasion [4], leveraging US corpos to harm lawful individuals doing their jobs in the EU [5], and sanctioning elected officials for performing their duties [6], or threatened to [7].

Sure, there's an hypothetical risk of the EU turning sour. On the other hand, when it comes to US corpos, the risk has materialized.

[1]: https://www.bbc.com/news/articles/cly930y90lro [2]: https://www.bbc.com/news/articles/c0589g0dqq7o [3]: https://www.politico.eu/article/twitter-faces-renewed-scruti... [4]: https://en.wikipedia.org/wiki/Greenland_crisis [5]: https://www.lemonde.fr/en/international/article/2025/11/19/n... [6]: https://www.brusselstimes.com/1931733/eu-parliament-blasts-u... [7]: https://www.politico.eu/article/us-accused-threats-eu-diplom...

Read your third link, please. The Ministry of Truth not being happy that their policy on "disinformation" isn't being applied as strongly as they wish isn't what I'd call "pushing heavy propaganda".

Yep. Color me shocked that the propaganda state media is unhappy with information being spread that doesn't conform to the views of the state, and so calls it propaganda or mis-/dis-information.

It's totally not the "ministry of truth".

GP means "Ministry of Truth" in the Orwellian-sense. The "Ministry of Truth" was the propaganda arm of the government just as the "Ministry of Love" is the interrogation/torture and brainwashing center.

> Because the US or Chine government can't harm me in Europe via the data they collect from me

That's an amusingly naïve perspective. The US government absolutely can harm you, via a multitude of ways.

Also, Chinese-owned firms are known to be transferring EU citizens' data to China in violation of GDPR: https://noyb.eu/en/tiktok-aliexpress-shein-co-surrender-euro...

China's government has strategic goals to destabilise and weaken the EU, and data-farming will be part of their strategy.

Not to speak of russia who have been sending assassins to kill people in the EU for a long time, and the EU has not been very good at stopping those.

> What about being required to carry a your-own-government-controlled tracking device?

What part of the cellphone manufacturer being based overseas makes you think the government can't track you via it?

Even leaving asides 5-eyes style data-sharing agreements, your US/Chinese smartphone still connects through a domestic cellphone carrier, using a domestic number. That's enough to have at a minimum fine-grained location tracking, call logs, and data usage.

In fact 5g and all previous standards have a provision for lawful intercept. So your domestic intelligence service and police can always turn it into a listening device.

Yeah it seems that some politicians have noticed that they can enact a lot of self serving authoritarian legislation that wouldn't fly otherwise if they push it as populist independence-from-US thing. Can't let a good crisis go to waste, of course.

One only needs a few looks at what the EU Commission has been doing lately to see that if left unchecked their plan is a UK-like total surveillance state.

I don't disagree but that wasn't the point here. The point is they are handing even more control to a different US entity. Putting my tinfoil hat on, I assume the authoritarians are intending to simply buy the data from the American companies to circumvent legal restrictions, as in the Five Eyes arrangement.

Carrying this device is the key here. Eventually we all need to carry it around, track us everywhere.

Most people have mobile phones that need to roughly know your position as a technical necessity, why are you speaking like its 1990's?

Not just the phone needing to know your location, your rough location has to be reported to a central server, because that's how incoming calls/texts are routed to the phone.

I can leave my phone at home and route SMS and voice via http to my real phone.

You are shifting the goal posts here - if we work by this argument, we will never achieve anything.

There's a certain amount of conspiracy theory going on in this thread, but it it right to ask: who will be banned from this payment system, and under what rules? Can we make it a legal requirement to at least provide a justification which can be challenged?

The usual first victims are sex workers, not political minorities.

The real human-rights issue, in my view, is optionality. If interacting with government or the financial system requires a specific proprietary device tied to a specific ecosystem, that's a problem

> Whatever they come up with, I hope it doesn't tie you to a Google or Apple smartphone.

The article starts with Wero right off the bat, which a pan-European rebrand and continuation of the Dutch Ideal. The Dutch have been using Ideal everywhere, and you usually use that to pay online. It redirects you to your bank to acknowledge the transaction, and most bank have auth methods where a smartphone is optional. Most often used for sure, but optional, and you can complete the transaction with a hardware reader and your debit card as well.

The only exception are the neobanks like Bunq, which actually are smartphone-only. That one in particular is great if you appreciate the CEO and staff keeping a personal eye on your transactions (no kidding).

So... there once was a company called First data. Founded by some JPMC execs who got chased out of the bank after being caught performing espionage for Palantir.

They sold their transaction platform as a service to Apple Pay. And funneled all your transaction data to palantir.

Financial networks are side channels for intelligence gathering. And that makes the folks doing them outside of your nation an adversary.

With the US choosing to become an enemy of western democracy in Europe, the need for more investment in building trusted core infrastructure is inevitable.

Certainly none of this is ever simple. But this is just a microcosm of a much larger shift across many industries in Europe and we as tech nerds should be mindful of the tectonic shifts that are happening currently. The capital investments occurring have serious long term implications for us all.

Really the folks doing them inside your nation are also adversaries. The worst ones in fact because they usually have the power or know somebody who has the power to jail you.

How has the US become an enemy of western democracy in Europe?

Maybe you missed it, but the US is threatening to attack an EU country for close to an year now.

Wero is expanding around Belgium, France and Germany while Bizum has "joined" the European Payments Alliance with Bancomat and SIBS from Italy and Portugal respectively, not sure how these work exactly as I'm also located in Spain.

My point being, if these payment systems start becoming more interconnected and join within a standard, I wouldn't be surprised if we eventually saw Bizum cards around here, Wero cards in other places, and many more.

At least that's my take on it. Of course there's still a long way to go, such as developing the system, banks adopting it, businesses adopting it, then customers (which would probably take years, many people wouldn't bother switching at least until their current card expires)

The transition will be probably smooth and transparent for business and consumers. Banks are already deploying payment terminal able to handle both Bizum and VISA/Mastercard [1]. Since banks own these terminals, they can decide how fast they want Bizum adoption to spread. Business don't even need to opt-in into it. At some point they can simply start charging for credit/debit cards and people will naturally switch to Bizum.

[1] https://www.bbva.com/es/es/empresas/bbva-primer-banco-en-esp...

> for the Android case, as you use it from your bank's app, it would typically require some Google security assurances - so no Huawei phones allowed, for example

I don't know about Huawei, but actually most (all?) of the banking apps in Spain should work on a non-Google-certified Android builds. There's an community list tracking GrapheneOS compatibility at https://privsec.dev/posts/android/banking-applications-compa... and all of them currently appear supported just fine.

GrapheneOS in Spain?

https://www.androidauthority.com/why-i-use-grapheneos-on-pix...

> Police in Spain have reportedly started profiling people based on their phones; specifically, and surprisingly, those carrying Google Pixel devices. Law enforcement officials in Catalonia say they associate Pixels with crime because drug traffickers are increasingly turning to these phones. But it’s not Google’s secure Titan M2 chip that has criminals favoring the Pixel — instead, it’s GrapheneOS, a privacy-focused alternative to the default Pixel OS.

EDIT: Previously on HN: https://news.ycombinator.com/item?id=44473694

Really makes you think when petty criminals use privacy tech while billionaire pedophiles run their dealings through gmail.

I guess they consider themselves untouchable.

Same here, I'm using Dutch banking and credit card apps (and iDEAL/Wero) without issues on a GrapheneOS phone (/e/OS works as well).

I use my credit and debit cards the same way today as I did before smartphones existed. I never invited the extra surveillance middleman of Google/Apple into my transactions. And the convenience of tapping or swiping a plastic card is simpler than using my phone anyway. Is this not possible in Spain?

I put my debit card in my smartphone case. Best of both worlds.

Yes, but in Spain all of our cards are Visa or Mastercard, afaik, so you can't really avoid using American tech in your daily payments (unless you use cash, which remains a very convenient method, by the way).

The fact you have the visa or mastercard logo doesn't mean you can't avoit to use their tech for your daily payments.

Example, in France most debit and credit cards are called "carte bleue" (literally blue card) but all of them either have a visa/mastercard logo. However when you pay with them you can decide with the merchant to use the CB system or the visa/mastercard. Sadly very few people know that and do the selection.

Interesting. I don't think there's anything similar here in Spain, though. On the other hand, in this same thread, somebody said Visa acquired that "Carte Bleue" system, and Wikipedia states it was discontinued in 2010. So maybe it's not possible to use anything other than visa/mc in France anymore

You mention an interesting thing I didn't realize before. Carte Bleues, the brand, seems to have been sold to Visa but CB, the payment system would still be a separate thing and now mean Carte Bancaire. It is not helped by the fact that french people literally adopted carte bleue as a generic name for payment cards.

https://en.wikipedia.org/wiki/CB_Bank_Card_Group

Thanks for the info. By the way, is there any difference, apart from not having to rely on foreign parties, for the buyer between selecting CB or Visa/MC for his payment? And I suppose it's the shop owner who decides the default when the buyer doesn't choose.

I'm with you. Low-tech works just fine. I hate the idea of having to depend on a working phone just to pay for things.

But isn't the promise of Apple Pay that you never expose your real credit card # to the merchant? So they can't track you? I know Walmart in Canada really resisted Apple Pay for a few years because it would mean no more ability to track people by their payment methods.

> But isn't the promise of Apple Pay that you never expose your real credit card # to the merchant? So they can't track you? I know Walmart in Canada really resisted Apple Pay for a few years because it would mean no more ability to track people by their payment methods.

Yes, this is exactly what Walmart does in the US since they still don't accept Apple Pay/Google Pay. When I go in and make a purchase using my credit or debit card, they'll associate it with my Walmart account and it'll show up as a "recent order" in the Walmart app because I have the same card saved there for ordering groceries online. They use those in-store purchases to recommend things to add to my grocery orders all the time.

> since they still don't accept Apple Pay/Google Pay. When I go in and make a purchase using my credit or debit card, they'll associate it with my Walmart account

Why wouldn't they be able to do that with at least Google Pay?

I pay with my phone using Google Pay at a Swedish grocery store chain and it's connected to my loyalty account there.

(Since I don't use Apple Pay I don't know if the same works there.)

I guess I'm not familiar with how Google Pay actually works, I assumed it was the same as Apple Pay. With Apple Pay the merchant gets a randomized card number on every transaction.

Too late to edit my comment, but it looks like I didn't quite understand how Apple Pay works either. After a little more research on both of them, here's the gist of it: Apple Pay and Google Pay both create a "Device Account Number" for your card, and this number never changes. When you tap your phone to pay, it generates a one-time cryptogram for the transaction which will always be unique. I was under the impression that merchants only get the cryptogram, but that's not the case – merchants get both the cryptogram and the DAN during the purchase.

The problem is, since the DAN is a stable number that never changes per card, they can save it and use it to recognize you across visits. That's how stores can tie Apple Pay/Google Pay transactions to loyalty programs without scanning a separate card. The DAN doesn't differentiate between online/in-app purchases and physical purchases either, though the number is different between devices (i.e. use phone to pay in-store, use computer or tablet to shop for groceries). But realistically, Apple Pay/Google Pay would only marginally improve the privacy in the Walmart scenario, which is a bummer.

> I never invited the extra surveillance middleman

What's an extra layer of surveillance? Why accept the "credit and debit" surveillance middlemen but not the google/apple middlenmen?

What the world needs are "cash cards". Something equivalent to cash not tied to your identity that you can use in the real and virtual world.

I simply do not understand why governments or the private sector do not provide such options.

Credit cards provide convenience and cash back benefits. Some might prefer to pay cash for everything for ultimate privacy, and that's fine. But credit cards are the compromise I make. I can still pay cash when I think it's appropriate for a given transaction.

Using Google or Apple Pay so I can tap my phone instead of my card gives me no extra benefit that I care about and complicates my ecosystem with another party.

> cash back benefits

Only in the U.S. In many other countries the processing fees are regulated by the government so the banks can't afford to give you your "cash back".

How dare Europe force card companies to distribute the cost of being poor on all customers. Cashback is effectively a special fee levied exclusively on those who don't qualify.

I was told the other day that the people most likely to choose to avoid the extra 2.5% fees are the wealthier.

In New Zealand, most low margin business (like cafes) ask you to accept an ~2.5% transaction fee (if you use a credit card or paywave). You can avoid the fee by using a debit card with a chip.

I'm unsure what choice the poorer make. If you're actually low income, maybe you don't go to cafes.

I did notice that a thrift store didn't charge the extra 2.5%: so perhaps poorer people have more pressure to use cards with fees?

Amex is noted for its high fees - so perhaps it is a bathtub where only the middleclass care.

When you have to care for money, visibility doing so feels like exposing weakness. But when you care for the little amounts while it's clear that this is unrelated to need, it turns into showing off a quality.

Yep. In Germany credit cards are a nuisance for banks. If you want one with cash backs and easy chargeback functionality, you are free to pay 60€ a month for an American Express Platinum card that works exactly nowhere in EU.

Governments frown upon KYC-less digital purse cards. Gotta force everyone to share their national ID number to just open a bank account to keep out drug dealers, terrorists, or NSFW game peddlers.

Banks generally don't like disposable digital purse cards. They make money off fees and interest. If a product doesn't rope you into a customer "relationship" where you link your pay deposits or later might get a mortgage or car loan they can only make money off fees. Enjoy paying $5 to activate a $100 prepaid debit card!

We used to have a "cash card" in Sweden in the 90's[0]. It flopped because nobody wants to keep manually re-filling it with value all the time. It's much more convenient to have a card that pulls from your bank account (either instantly via debit or monthly via credit). In the mass market, convenience always trumps privacy.

The places where a "cash card" have gained popularity have all been using the "backdoor" of public transit payments that are so ubiquitous they also get accepted by retail (e.g. Suica in Japan, Octopus in HK, EasyCard in Taiwan, etc)

[0] https://sv.wikipedia.org/wiki/Cash_(betalsystem) based on the Belgian Proton https://en.wikipedia.org/wiki/Proton_(debit_card)

Ah, yes, we had those in The Netherlands as well (Chipknip), everybody hated those cards (though if I remember correctly most debit cards also doubled as a Chipknip card), but many parking meters used them for some time.

Thanks! ANOTHER SANE voice of reason! Nothing tops the simplicity of using plastic, either via chip or NFC. Leave the friggen' phone at home!

> I use my credit and debit cards the same way today as I did before smartphones existed.

How exactly are you doing that? with 3D Secure online credit card transactions now require confirmation in the mobile app (or via OTP sent by SMS, but this is being phased out, as it is insecure)

This "Play Integrity" garbage is the first thing europe should break with. Instead we have Italian government app refusing to run on devices not serving Google's interest.. shame.

Also often a requirement on govt digital identity apps...

On Portugal we have the Multibanco network, which already provided Internet like services for buying stuff on the terminals and eventually graduated to have online payments as well, however only in Portugal.

Likewise, in Germany we can have SEPA for most stuff.

And in Greece there is Viva.

Problem is getting something that actually works across all European countries.

Show me a german webshop that supports modern payment methods. It usually old school bank transfers still.

I just bought Kampot peppers from https://www.unclespepper.com/ which is in Germany, the name notwithstanding. And yes, I paid with my Danish Visa card. No problems except that I had to adjust my ad blocker once.

Which payment method is missing from Zalando? https://en.zalando.de/ It’s a German company

Yes, why did I mentioned SEPA?

It works for the purpose to pay something online.

If you want an example, Eurowings.

I have never paid anything via bank transfer, where are you buying?

I order all over Europe (including Germany) and I cannot remember the last time I did a manual bank transfer.

On the other hand, I have already seen Germans complaining about the lack of possibility to buy train tickets by bank transfer.

You must frequent a very interesting subset of German web shops then. Yes, some do offer bank transfer (many don't because latency is just so terrible), but I've never seen credit card not on the list. Perhaps with the exception of credit card available only through some intermediary like PayPal (which I tend to prefer over direct credit card, I don't really like spreading my CC details to servers of questionable maintenance state than strictly necessary)

It is quite recent though, but the webshops do all accept credit cards, most of them even use stripe for payments.

Now, of course our corner shop appliance store still only accepts cash. It was fun to pick up cash from multiple ATMs and pay 1500€ with a pile of 20€ bills a few months ago.

The problem isn't just getting something that works across all European countries. It's getting something that works globally.

While we may make most of our payments within EU, basically everyone still occasionally pays for something outside of EU, either online or when they travel. This means if the new thing only works in EU, every European will still need and have a MasterCard/Visa even if they use it less often than before.

This is still a massive amount of leverage - MC/Visa still have the ability to block payments made from EU citizens/companies to outside.

Also European merchants who need to accept payments from non-Europeans need to accept Visa and Mastercard.

Of course but they can support an EU standard as well. It's not mutually exclusive.

The big benefit is that all internal EU card transactions are no longer routed via US companies which is quite ridiculous.

Internal transactions all over the world are routed through US companies. I have paid using Visa or Mastercard at some point in Australia, Indonesia, India, Frnce, Sri Lanka, Singapore, Dubai.....

its not exclusive, but there is a problem with network effects. From the point of view of a business why should they add support for a new payment system no one users, from the point of view of consumers why should they sign up to a new system that no one accepts?

As I said in another comment the most likely alternative is a more decentralised system that all countries/currency blocks that want sovereign payments can get behind.

It's a problem for two reasons. First of all it means American companies get access to a lot of privileged information. Secondly, them pushing foreign morals eg sexual content or services being blocked.

If there were an EU card system id certainly sign up for it and demand from vendors that they support it. I don't want my data ending up in America especially these days.

The network effect will work out fine because we have reasons to want it.

Its a problem but a global one, not merely a European one.

Network effects are very powerful.

You might care enough about privacy but most people have given up.

You can buy things from your local Amazon or national equivalent that come from outside using this systems, so, you are not so restricted to EU sellers.

I suppose the most problematic would be traveling. I recently when outside the EU and was surprise how smooth the process was using my Visa card, to the point I didn't use any local currency.

On the other hand, I recently buy books from the UK and it get stuck for two weeks in customs, and it had nothing to do with the payment platform. I had not realized how difficult is to import something from outside the EU, even for personal use.

Many (most? all?) of the payment systems I’ve used over the years can interop with Visa or Maestro. Case in point: my Bancontact cards can pay in any Belgian business even if they can’t afford the better machines that do VISA, but my card also has the VISA logo. Same in Portugal and Germany.

If you can give merchants something that costs them only 0.1% in interchange fees, you can be pretty certain they’d jump on it.

If you build it on IBAN it already works everywhere.

The problem isn't just getting something that works across all European countries. It's getting something that works globally.

The Dutch iDEAL, on which Wero is based, already works for a lot of global payments. E.g. Stripe and Shopify support iDEAL:

https://stripe.com/en-nl/payment-method/ideal?__=

https://help.shopify.com/en/manual/payments/shopify-payments...

I regularly get offered iDEAL as a payment option when ordering outside of Europe.

I've been in Portugal sometimes, and to me MB was synonymous with "we accept credit cards", and in fact it is in the sense that you can pay using Visa or Mastercard in those shops. But, is it a standalone system that doesn't require anything outside Portugal in order to work? With their own non-Visa credit cards? And can you use them when abroad in the EU, for example?

It's a standalone network. Most Portuguese cards are also VISA/Mastercard, but payment terminals may only have a contract with Multibanco, meaning only Portuguese cards are accepted. It's quite common for foreign cards not to be accepted.

Nope, it has nothing to do with credit cards, although it also accepts them.

It is majorly used for debit cards, and similar in use to the famous Minitel in France.

You can use it to load pre-pay phones, or other kinds of rechargeable services, buy tickets for public transport and various kinds of shows, pay water, electricity, taxes, among other services.

There is now an app used to pay on shops via QR codes.

You can also pay online with one time cards, that are generated for a single transaction.

Outside Portugal it is a regular debit card.

When you access Multibanco with foreign cards, you can only withdraw money usually.

I'm French and living in Portugal and I do not get the Minitel comparison. Minitel was basically a Telnet device to various services' servers.

That said, I love MB and MB Way. What an upgrade it's been over paying for stuff in the US (where I lived before moving to Portugal).

From what I know from Minitel, the same Internet before the Internet applies.

I was buying tickets on MB, before it became common place in the Internet.

Could you search for tickets and such on MB?

All the stuff I'm familiar with is only payments (with entity and reference).

Now that I think about it, you could search for things on Minitel but I don't remember if payments were made as phone charges or if they could also be done with transfers.

Minitel was so prohibitively expensive to use (just about every service cost multiple francs per minute), I didn't do much with it.

Yes, for concerts, matches, CP (including the seat on IC/Alfa).

https://immolusitania.ch/the-real-deal-with-atm-machines-in-...

SEPA would be a decent solution with instant QR code generation and app payments, but the transfer fees are ludicrous for daily use (~1-2€ per wire). Or maybe it's just my bank being greedy fucks as usual.

It is your bank, I don't pay for transfers.

Yes. In some eastern EU countries instant SEPA payments with QR are already super popular because you don't pay fees and you don't need special terminal/gateway.

Huh, I thought the EU had mandated for instant SEPA transfers to be free. Maybe it’s just national. What country are you in?

Of course there is no mandate to offer anything for free. They just need to be offered for the same price as other methods.

But most people have a bank account for a fixed price and some even for free. So individual transfers are considered free, even if the correct term would be "already paid".

Fair enough, been so long since we had paid transfers here, I forgot it used to be a thing.

I never paid for SEPA transfers. Some countries are weird. I am not sure if it is still the case, but Germans had to pay a transfer fee when they used an ATM from another bank. In The Netherlands, you can use ATMs from any Dutch bank without extra cost. In fact, you can also use ATMs of German banks without additional cost. So, a having a Dutch debit card in Germany was/is(?) cheaper than a German debit card in Germany.

Instant SEPA is free - see Instant Payments Regulation (IPR) — Regulation (EU) 2024/886.

Hmm does instant SEPA differ in some way from the regular kind? I just checked and my bank still lists 0.4-1.1€ per external transfer. It's the national bank so I presume they're not likely to be in breach of EU regulations.

Mine did too a year ago or so still (N26). Now they are free due to it being mandatory in EU.

Only mandatory in Eurozone countries, sadly. It won't be until 2027 (July at the latest?) where it will be mandatory for all EU countries.

SEPA gets blocked immediately when you try to buy something expensive, like a top-end graphics card (8k+).

I consider some flights already expensive enough, and have had no issues, unless I got lucky.

An Indian friend of mine, constantly raves about their UPI system:

https://en.wikipedia.org/wiki/Unified_Payments_Interface

It sounds a lot like what they're discussing.

Oh it is good. It has its drawbacks (like everything else) but it's quite the de facto now and UPI Lite ( a wallet not on individual apps but on UPI/NCPI f/w itself) had made it even better.

There's so much trust / dependency on NPCI at this point but I recently learned that it's not a public entity and thus excluded from the transparency acts such as RTI. I hope the EU does better!

I am not sure which country you are from but is the term “accountability” even relevant in India anymore? It’s been non existent since more than a decade.

I was just commenting on how good, widespread it is and no it is not the doing of the current Govt. It just gained traction during a massive f up of the current Govt.

My friend says even the poorest Indians use it.

You can buy vegetables at a farmer's market, and just scan a QR code.

It’s everywhere. On the hills, on the boats (yeah I paid for roasted peanuts on one but it was close to the shore), rural, urban, semi rural etc.

FWIW, I'm using Bizum on a daily basis in Spain, on a de-googled android phone running e/os/, via my bank app (revolut)

> Whatever they come up with, I hope it doesn't tie you to a Google or Apple smartphone.

I would also hope so, that is the entire point. The reason they are scrambling right now is because Starlink just shut off all of Russia. Because Starlink was so cheap and easy (and stable for the last 4 years of the war), a lot of people in Russia stopped using any other form of internet access. And while all of Europe is happy to see Russia go away, they are concerned that the same can be done to them at a whim by any number of American companies. So they are trying to quickly create alternatives to anything American including software providers like Microsoft 360.

As for credit cards, it is not as if there is something intrinsically American in credit card processing. They can just as easily create a new system that uses the same protocols as Visa and Mastercard.

Having your entire economy dependent on a company you don't control in a country you don't control was considered acceptable for as long as a concept of "allies" existed. That is not the world we are living in right now.

> they are trying to quickly create alternatives to anything American

They're the same bright minds that ensured no alternatives could naturally come out of the European market trough relentless bureaucratic central planning. I have zero hopes of a good outcome

Actually European integration the last 30 years has been pretty remarkable. In the past, not even electric plugs were compatible. But the EU is not a country. A lot of the inefficiencies are actually features sought by key members to protect their own local incumbents.

Your best example of European integration is electric plugs?

How about tap water has to be drinkable in every EU country

Many non-eu countries have drinkable tap water, not sure how representative of "integration" this rule is.

And many non eu don't have. I am neutral on the eu topic but you are confused. If this eu thing can mandate certain water standards or expel a country and or withhold common funds, that's a very different thing from seeing "some" non eu countries having water.

USB-C!

Money transfers between bank accounts for no extra fees (well, that's limited to the Euro, so a couple of countries chose to stay outside). Mobile phone usage for no extra fees all over EU (some limitations, but typically not relevant for the average trip).

B2B the integration has even bigger impact.

I don't think eletric plugs are even regulated. British plugs never changed and they were not an argument in Brexit.

All of those things don't require having a supranational body who you relinquish large parts of your sovereignty to.

Which is why bank to bank transfers are so easy in the US.

I wouldn't say that transfers are easy in the EU.

My bank requires me to fill in a paper form, scan it, send it by mail, wait a week, then get an answer (often, "no, give us more details") if I want to send money in another country. Neobanks tried to solve this for lower amounts, but will freeze easily your account for "AML" if you send low six figures.

Free cellphone roaming is a big plus.

It isn't bureaucracy that has prevented any alternatives emerging; it's network effects. Mastercard and Visa have a solid duopoly.

> Because Starlink was so cheap and easy (and stable for the last 4 years of the war), a lot of people in Russia stopped using any other form of internet access.

What are you smoking ..err.. any source to your claim ? (Which is between bizarre and just plain wrong).

Never mind russians putting starlinks on flying bombs to blow up Ukrainians. But those poor Russian Internet users you invented. While it’s jailable offense in russia to own starlink.

I think you misunderstood, I do not pity them at all. I am just pointing out it is bad strategy to be dependent on foreign potentially-hostile technology.

In particular, I heard this through Mallen Baker at https://www.youtube.com/watch?v=7ACzkuSFzT4

> Starlink just shut off all of Russia

What are you talking about? Starlink never worked in russia. It worked in Ukraine, and it was shutdown in Ukraine by using a white list for which any Ukrainian can easily apply.

The goal was to shutdown Starlink usage by russian drones in Ukraine and by anyone on the occupied Ukrainian territories.

Starlink was never available in Russia due to the sanctions regime. It's only use by Russians was via grey import terminals on the frontline in Ukraine (made possible due to complications of geofencing).

I guess I was misunderstanding. I thought that Starlink was deliberately ignoring the sanctions because they were able to shut it off real quick once Musk got that tweet https://x.com/sikorskiradek/status/2016221397396168995

You might be thinking of Ubiquiti, who were exposed as blind eyeing the sanctions

It wasn't easy to geofence due to fluid nature of the frontline and lack of single official supply channel to Ukraine. A huge part of Ukrainian terminals were also procured abroad by volunteers.

However a recent development was Russian use of terminals on attack drones. Out of that Starlink was able to block terminals with certain velocity (and possibly bearing) in the region. In addition Ukraine got around to making internal registry of all frontline terminal allowing Starlink to white-list. So no it was a bit more than a tweet involved.

You did misunderstand:

https://x.com/FedorovMykhailo/status/2017932529882296706

SpaceX worked with Ukraine together to register authorized Starlinks.

You obviously can’t simply geo-fence because the usage is not in Russia, but Russian troops using it in Ukraine.

And you can’t simply blacklist Russian use, because lots of devices with legitimate Ukrainian use cases were imported in privatly or by third party.

That is why legitimate Ukrainian devices must now be cumbersomely whitelisted.

> a lot of people in Russia stopped using any other form of internet access

What you're saying is just plain false. No one has ever used Starlink in Russia. It doesn't even work here. It never did. Russian troops were using Starlink on Ukrainian territory, that's what was shut off.

What are you talking about, 92% of Russian population has access to internet via landlines, the government subsidised building all the infustructre. The internet access is one of the cheapest in the world($5-10 per month for 100-500mbit/s), starlink with its $50-120 price tag is not affordable at all, ignoring the fact it doesn't even work here

Misinformation on HN? Well, I never!

Where did you get "4 years"? And what makes you think people in Russia were using the service?

UPI in India if I remember correctly can actually work even offline by either sms/calling functionality even on dumb phones

Pasting this ddg-ai thing but I think its called UPI 123PAY

UPI 123PAY allows users to make digital payments using feature phones without needing a smartphone or internet connection. Users can set up a UPI ID by dialing *99# and can make payments through methods like IVR calls, missed calls, or sound-based technology.

https://razorpay.com/blog/what-is-upi-123-pay/

They should just do on the lines of what India has been doing with UPI and Brazil with Pix. Both massively successful at this point. Of course take their good parts.

By the way, since you wondered, it seems to be

> built around the digital wallet Wero

and wikipedia says its a mobile payments method. I hope not. I hope it's rather an interface/spec.

(On a side note, I also hope individual countries of EU ensure that those spec leaves an ability for them to continue internally or even externally if rest of the EU decide to cut someone off or so.)

> Brazil with Pix

Are you aware of any banks that don’t require you to use their Android/iOS app to use PIX? I’ve had accesss to maybe a dozen banks and none had that ability. Sometimes you get via web, but needs their app’s 2FA to log in.

EPI is the interface and it's built upon SEPA and TARGET standards.

Wero is the implementation. I think it makes sense to provide a turnkey solution to all participating banks, so that we don't have 100+ versions of the same app.

Countries that don't want to trust EPI (or simply outside the Eurozone) are able to take the same path as Bizum in Spain, and make their domestic solution interoperate with EPI instead of replacing it.

> Of course take their good parts.

I completely agree. Sadly UPI is now almost completely dependant on platform integrity ( google and apple).

You need to research better before forming and sharing wrong opinions about world's most popular payments system: UPI.

UPI will work even without a smartphone, it will work on even with a basic feature phone, using USSD codes! That's called UPI 123PAY.

https://www.msn.com/en-in/money/news/upi-without-smartphone-...

This feature allows rural populations, poor people, small merchants, etc., to send and receive UPI payments, even without a smartphone.

So UPI has no dependency on Google or Apple, it can work on any basic phone that supports USSD codes feature!

A key patent on this is held by a friend of mine. He tried to monetise this tech way before operators were ready.

I forget what the company was called, m-pay or something like that.

> Whatever they come up with, I hope it doesn't tie you to a Google or Apple smartphone.

Even if it does, Google won't be taking a cut from it.

Also, it's then much easier to provide a mobile web version, or something else.

My country's internal system also sells a bracelet for contactless payments, and there are obviously payment cards.

Once there's a mandatory standard, it's much more likely competition will show up. EU wide SWIFT, direct debits, instant transfers, all show this.

What would Google prevent from taking a similar cut as Apple is taking?

Lack of negotiation power. Less control over Android than Apple has over iOS.

Google keeps self-sabotaging Android Pay. They lacked market power so cellular carriers blocked it hoping to advance their own payment ecosystem (ISIS). Google changes the payment brand every few years, and fragments it into two separate apps or combines them. It's rather like their messaging strategy.

What's being discussed isn't Google or Apple Pay.

It's an app that uses NFC or, if needed, reads a QR code and does a web request (i.e. needs internet).

Neither Google nor Apple will block that, or take a cut; and it's already available in multiple markets.

This is about taking stuff that already works in one or two countries, design a similar system that works across countries, and mandate that all banks under ECB supervision implement it.

Digital Markets Act, also Apple nearly lost their payment monopoly in Germany as powerful banks lobbied for a law forcing them to open up. It was passed, but then they didn't want to use it. If I would guess, Apple offered them preferential conditions to not have a precedent.

https://financefwd.com/de/sparkassen-apple-nfc/

Cards are really slow and expensive to distribute and (tech forward) people would also prefer to just use their phone or watch. This is the kind or project that will take years to work and almost everybody now has a smartphone on one of those two operating systems in their pocket every time they leave the house.

Cards will have a slow demise over the next 10 years but it's coming whether we like it or not.

Support both?

Like to log into e-banking services over here we either have phone apps, or a code calculator device that can be used instead of those: https://www.seb.lv/en/private/daily-banking/tools-and-online...

Seems like common sense to me, the same how I have a wallet on my phone but still carry cards for payments just in case.

Well, at least in Spain cards typically take between 3 or 5 days to get to you via post mail when you first open your account in a bank, and when it's about to expire, from time to time, you get the new one weeks in advance.

So I don't think distribution is a problem. Of course companies would prefer to save the cost, and they also prefer that you use their applications, but I just don't think it's more convenient for the end user. Taking a card with you is not a big deal while having to use a mobile application or approved device limits your freedom to choose which smartphone you want to use or how to use it.

Definitely. I have spent the last few days trying to get a replacement "Digipass" device for a bank account I run for a small sports club. The bank was very reluctant to issue a new one as they want to move everyone onto their app to generate codes for logging in to their website. Trying to argue that even if their app worked now on a de-Googled Android device there was no guarantee that they wouldn't require Google's safetynet etc. at some point in the future was a failure. They did not understand this and decreed that the app not working, or possibly not working, on one's phone was "not a valid reason" to be excused from using the app. Luckily because the account is a business account I was able to claim that using banking apps on phones was against company policy (I set the policy myself), which is an excuse they were willing to accept. For now.

Any solution they come up with will benefit some company that implements the solution. Most likely there already exists a company (it could be Visa or Mastercard) that has the solution ready and they're lobbying for this to happen.

I don’t see why they can’t just piggyback on existing, proven solutions such as Bancontact, Carte Bleu, etc., which are all based on a card running on its own network. If it’s app-based, we’re excluding quite some citizens from it.

Visa bought Carte Bleue in 2011. Yep.

Nice... /s

I thought Carte Bleue no longer existed?

The selling of sovereign infrastructure to foreign actors is a failure of regulation. I’m baffled as to why that was approved.

Some of these are 40+ years old.

It makes sense to build upon modern SEPA payment rails and focus on mobile wallets. Europe has always been on the forefront (Swish, Vipps, ...) and we have entire generations of consumers who barely if ever use plastic cards.

Canada has the interac system and it works pretty wonderfully, it's integrated into other systems for overseas compatibility but it can operate entirely independent of VISA/Mastercard if the POS supports it.

I hope they go with Taler, personally. Privacy of cash but the required traceability for merchants.

What about a implant that can be placed into your palm? It can carry everything about you and be tied to your pulse so that if you have a panic attack or something as you are being robbed it wipes everything but your name and basic information.

> implant that can be placed into your palm

Might as well make it to the brain while we are at it. Safe when one is brain dead or unconscious. What say?

The Portuguese alternative "MB Way" has small NFC tags that can be tied to your account and used instead of the phone. You still need to register it in the phone. But it's a small step in the right direction.

It's true that it's a problem, but it can be easily fixed in the future. For example they could just change the app to work on any old android fork. You still get the benefit of no longer having transaction data run through the US.

But right now many of us are concerned with not being able to run e.g. GrapheneOS without locking ourselves out of all basic digital infrastructure. We shouldn't wait until it gets untenable for the EU to lock us into Google and Apple, we want independence from the start.

Not to mention that we are essentially forced to give up accsss to all of our private data stored on our phones to either google or apple because you have their rootkit (Google Play Services in the Android case) installed

If the interfaces are simple, straight to the point, able to do a good enough job, all that in a modular fashion. It should be rather ok.

But 99.99% of the time won't be the implementation of such interfaces, but monitoring and security.

With my bank (bankinter) you can bizum from a browser (just checked).

Sorry: This is Spain (to clarify).

Logical next steps: 1. European app store that has to run on Android/iPhone 2. European phone (platform) -- maybe as a joint venture of different European players / not a single company.

Real independence requires thinking about the full stack

This. A sane voice of reason in an insane, software-tech dork driven world.

Physical cards ftw!

Btw i love simply using cash in South America when getting a taxi, no stupid "apps", no tech nonsense. Just wait at a proper spot and hail.

I think absolutely Europe needs it's own mobile OS. And thankfully they can "just" fork Android - or better still, adopt one of the existing forks.

I suspect simply stating that it must be a supported standard will do most of the work, much like standardising phone chargers.

Reply on news.ycombinator.com